{"investigation":{"slug":"arcadia-v1","entity_name":"Arcadia Finance v1","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Arcadia Finance v1 was a decentralized margin lending protocol deployed on Ethereum and Optimism that suffered a critical reentrancy exploit on July 10, 2023, resulting in the loss of approximately $459,030 across both chains. The attack exploited a missing reentrancy guard in the vault liquidation function combined with absent untrusted-input validation, allowing the attacker to bypass collateral health checks and drain darcWETH and darcUSDC vaults. The stolen funds on Optimism were largely laundered through Tornado Cash; the protocol subsequently paused all contracts and issued a bounty ultimatum to the attacker that went unanswered.","sections":[{"content":"Arcadia Finance launched as a decentralized, composable margin protocol permitting users to lend, borrow, and leverage crypto assets against collateral held in user-owned smart-contract vaults. The v1 deployment operated on Ethereum mainnet and Optimism, with lending pools denominated primarily in WETH and USDC. The protocol attracted backing from Coinbase Ventures, Global Founders Capital, Keyrock, Psalion, and several other venture funds, positioning it as an institutional-grade DeFi primitive. A single audit of the complete v1 codebase was conducted by Nethermind in Q4 2022 through Q1 2023, approximately six months before the July 2023 exploit. At the time of the exploit, total value locked across both chains stood at roughly $605,000.","heading":"Protocol Background","sources":[{"url":"https://docs.arcadia.finance/security-and-risk/audits","name":"Arcadia Finance Security & Audits documentation","type":"official","credibility":1},{"url":"https://arcadiafinance.medium.com/introducing-arcadia-v2-79ee345af20b","name":"Introducing Arcadia V2 — Arcadia Finance on Medium","type":"official","credibility":1},{"url":"https://www.coinbase.com/web3/dapps/arcadia","name":"Arcadia Finance DApp listing — Coinbase","type":"other","credibility":2}],"severity":"low"},{"content":"On July 10, 2023, an attacker exploited two compounding vulnerabilities in the Arcadia Finance v1 smart contracts: a missing reentrancy guard on the vault liquidation function and an absence of untrusted-input validation in the vaultManagementAction() call. The attack flow allowed the attacker to call liquidateVault() during an ongoing multi-call sequence — specifically within the window after vault assets were withdrawn but before the final collateral health check executed. By reentering the contract indirectly through the path LendingPool → Liquidator → Vault, the attacker triggered instant liquidation and bypassed the protocol's internal solvency checks entirely. Security firm PeckShield was the first to publicly identify the vulnerability and alert the community, characterizing the root cause as 'the lack of untrusted input validation' combined with missing reentrancy protection that 'allows for the instant liquidation to bypass the internal vault health check.' The Arcadia team confirmed the attack approximately two hours after PeckShield's initial alert and immediately paused all liquidity-pool-related contracts and set interest rates to zero to prevent further losses.","heading":"July 2023 Exploit: Reentrancy Vulnerability","sources":[{"url":"https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0","name":"Arcadia Finance Post Mortem — Medium","type":"official","credibility":1},{"url":"https://cointelegraph.com/news/arcadia-finance-hacked-on-ethereum-and-optimism-for-455k","name":"DeFi protocol Arcadia Finance hacked on Ethereum and Optimism for $455K — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://cryptodaily.co.uk/2023/07/defi-platform-arcadia-finance-hacked-for-455k","name":"DeFi Platform Arcadia Finance Hacked for $455K — Crypto Daily","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/defi-protocol-hack-drains-455k/","name":"DeFi Protocol Hack Drains $455K from Arcadia Finance — Crypto Briefing","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Total confirmed losses from the July 10, 2023 exploit amounted to $459,030.44 across two chains: approximately $123,758 on Ethereum mainnet (comprising USDC and ETH from the darcWETH vault) and approximately $335,271 on Optimism (comprising USDC and ETH from the darcUSDC vault). The attacker on the Optimism chain held wallet address 0xD3641C912a6A4c30338787E3C464420b561A9467 and bridged approximately 148 ETH while converting 59,000 USDC before routing the majority — roughly 179–180 ETH — through Tornado Cash within hours of the exploit. The Ethereum-side attacker, associated with address 0x5C75e94dD0Ab9c10BFd1B8073DafEF031D3c050d, retained stolen funds in the wallet at the time of initial reporting; this address was reportedly preceded by an MEV bot that frontran part of the Ethereum-side drain. Total value locked on Arcadia Finance v1 collapsed 76–77% following the exploit, dropping from approximately $605,000 to $140,000–$145,000.","heading":"Losses and On-Chain Fund Movement","sources":[{"url":"https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0","name":"Arcadia Finance Post Mortem — Medium","type":"official","credibility":1},{"url":"https://www.cryptopolitan.com/hacker-exploits-vulnerability-drains-455000-from-defi-protocol-arcadia-finance","name":"Hacker exploits vulnerability, drains $455,000 from DeFi protocol Arcadia Finance — Cryptopolitan","type":"news_article","credibility":2},{"url":"https://protos.com/arcadia-finance-says-exploiter-contacted-after-450k-hack/","name":"Arcadia Finance says exploiter contacted after $450K hack — Protos","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/arcadia-finance-hit-by-455k-exploit-on-both-ethereum-optimism-networks/","name":"Arcadia Finance Hit by $455K Exploit on Both Ethereum, Optimism Networks — CryptoPotato","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the exploit, the Arcadia Finance team paused all protocol contracts, set interest rates to zero, and engaged three blockchain security firms — BlockSec, Hexagate, and PeckShield — to assist with the investigation. The team stated it contacted international law enforcement and reached out to the attacker's on-chain wallet addresses, though no response was received at the time of reporting. In a subsequent on-chain message, the team issued a 24-hour ultimatum to the attacker: return 90% of stolen funds and retain 10% as a white-hat bounty with no further legal pursuit, or face a 10% public bounty for information leading to the attacker's identification, arrest, and conviction. The attacker did not comply with this ultimatum. According to the official post-mortem, the team planned to remediate the vulnerability by adding a reentrancy guard to the vault function and conducting additional security audits before any reactivation of the protocol.","heading":"Team Response and Bounty Ultimatum","sources":[{"url":"https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0","name":"Arcadia Finance Post Mortem — Medium","type":"official","credibility":1},{"url":"https://cointelegraph.com/news/arcadia-finance-hacker-used-reentrancy-exploit-team-demands-return-of-funds","name":"Arcadia Finance hacker used reentrancy exploit, team demands return of funds — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.dlnews.com/articles/defi/coinbased-backed-arcadia-finance-offers-hacker-bounty/","name":"Arcadia Finance hits $3.5m hacker with ultimatum: pay up or get hunted — DL News","type":"news_article","credibility":2},{"url":"https://protos.com/arcadia-finance-says-exploiter-contacted-after-450k-hack/","name":"Arcadia Finance says exploiter contacted after $450K hack — Protos","type":"news_article","credibility":2}],"severity":"high"},{"content":"The July 2023 Arcadia Finance v1 exploit received coverage in the same news cycle as research by on-chain investigator ZachXBT, whose work on a separate Canadian NFT rug pull class-action lawsuit was cited concurrently in crypto media roundups covering the Arcadia hack. Outlook Business's crypto news roundup from July 10, 2023 directly paired the headline 'Hacker Drains $455K From Arcadia's Ethereum, Optimism Vaults' with coverage of ZachXBT's research being cited in a Canadian legal case, reflecting the investigator's prominence in the DeFi security community during the period. Primary technical attribution for the exploit was made by PeckShield, which issued the first public alert and identified the dual vulnerability. No specific ZachXBT thread or Mirror post dedicated solely to the Arcadia Finance v1 exploit has been confirmed by available sources, and claims linking ZachXBT to a standalone Arcadia Finance investigation should be treated as low confidence absent primary source confirmation.","heading":"ZachXBT and Community Investigator Coverage","sources":[{"url":"https://www.outlookbusiness.com/news/latest-crypto-news-hacker-drains-455k-from-arcadia-s-ethereum-optimism-vaults-zachxbt-s-research-cited-in-canadian-nft-rug-pull-class-action-lawsuit-news-301762","name":"Latest Crypto News: Hacker Drains $455K From Arcadia's Ethereum, Optimism Vaults; ZachXBT's Research Cited In Canadian NFT Rug Pull Class-Action Lawsuit — Outlook Business","type":"news_article","credibility":2},{"url":"https://zachxbt.mirror.xyz/","name":"ZachXBT — Mirror.xyz (investigator's publication hub)","type":"other","credibility":2}],"severity":"medium"},{"content":"Following the July 2023 v1 exploit, Arcadia Finance undertook a significant protocol redesign and launched Arcadia v2, which underwent multiple audits by Trust Security (Q4 2023), Sherlock (Q1 2024, focused on lending-v2 and accounts-v2), and Renascence Labs (June 2024). A Nethermind audit covered the complete v1 codebase in Q4 2022 through Q1 2023, representing the only security review prior to the initial exploit. Despite the expanded v2 audit programme, Arcadia Finance suffered a second major exploit on July 14–15, 2025, when an attacker drained approximately $2.5–3.6 million from the protocol's Rebalancer contract on the Base blockchain, exploiting an unchecked external call in SwapLogic._swapViaRouter(). A Pashov Group audit had previously reviewed the vulnerable function but closed the issue internally without escalation, concluding it could not be exploited. The pattern of repeated critical vulnerabilities across both v1 and v2 codebases indicates systemic weaknesses in the protocol's security review and threat-modelling processes.","heading":"v1 vs v2 Distinction and Subsequent Exploit History","sources":[{"url":"https://docs.arcadia.finance/security-and-risk/audits","name":"Arcadia Finance Security & Audits documentation","type":"official","credibility":1},{"url":"https://rekt.news/arcadiafi-rekt","name":"ArcadiaFi — Rekt News (July 2025 exploit analysis)","type":"research","credibility":2},{"url":"https://cointelegraph.com/news/arcadia-finance-exploit-2-5m-crypto-theft","name":"Arcadia Finance Suffers $2.5M Exploit on Base; Funds Converted to WETH — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://cryptonews.com/news/hackers-drain-2-5m-from-arcadia-finance-on-base-blockchain-heres-what-happened/","name":"Hackers Drain $2.5M from Arcadia Finance on Base Blockchain — CryptoNews","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The v1 codebase underwent a single pre-launch audit by Nethermind conducted in Q4 2022 through Q1 2023. That audit did not identify the reentrancy vulnerability in the vault liquidation flow that was exploited six months later in July 2023. The v2 codebase received four audits from separate firms, yet still suffered a critical exploit in July 2025 when an unchecked external call in the swap router went undetected — or was detected and dismissed — by the Pashov Group. This pattern is consistent with broader industry findings that single-firm audits frequently miss composite vulnerabilities requiring multi-step attack chains, particularly in protocols combining flash loans, reentrancy paths, and arbitrary calldata execution. The absence of an immutable reentrancy guard on vault actions in v1, despite Nethermind's review, raises questions about the scope and depth of the pre-launch security process.","heading":"Audit Gaps and Security Process Failures","sources":[{"url":"https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0","name":"Arcadia Finance Post Mortem — Medium","type":"official","credibility":1},{"url":"https://docs.arcadia.finance/security-and-risk/audits","name":"Arcadia Finance Security & Audits documentation","type":"official","credibility":1},{"url":"https://rekt.news/arcadiafi-rekt","name":"ArcadiaFi — Rekt News","type":"research","credibility":2},{"url":"https://immunebytes.com/blog/arcadia-finance-exploit-detailed-hack-analysis/","name":"Arcadia Finance Hack Analysis — ImmuneByes","type":"research","credibility":2}],"severity":"high"}],"timeline":[{"date":"2022-10","event":"Nethermind begins audit of complete Arcadia Finance v1 codebase (Q4 2022 – Q1 2023).","source":"Arcadia Finance Audits Documentation","source_url":"https://docs.arcadia.finance/security-and-risk/audits","date_original":"2022-10-01"},{"date":"2023-07-10","event":"Attacker exploits reentrancy vulnerability in Arcadia Finance v1 vault liquidation function on Ethereum and Optimism. PeckShield issues first public alert. Total losses: $459,030 ($123,758 on Ethereum; $335,271 on Optimism). Attacker addresses: Optimism 0xD3641C912a6A4c30338787E3C464420b561A9467; Ethereum 0x5C75e94dD0Ab9c10BFd1B8073DafEF031D3c050d.","source":"Arcadia Finance Post Mortem / CoinTelegraph","source_url":"https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0"},{"date":"2023-07-10","event":"Arcadia Finance team pauses all liquidity pool contracts, sets interest rates to zero, and engages BlockSec, Hexagate, and PeckShield for investigation. TVL falls 77% from $605K to $140K.","source":"Arcadia Finance Post Mortem","source_url":"https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0"},{"date":"2023-07-10","event":"Optimism attacker routes approximately 179 ETH through Tornado Cash. Ethereum attacker retains funds in wallet. Team contacts law enforcement and sends on-chain messages to attacker addresses.","source":"Protos / Crypto Daily","source_url":"https://protos.com/arcadia-finance-says-exploiter-contacted-after-450k-hack/"},{"date":"2023-07-11","event":"Arcadia Finance issues 24-hour on-chain ultimatum: return 90% of stolen funds and keep 10% as white-hat bounty with no legal pursuit, or face a 10% public bounty for information leading to identification and arrest. Attacker does not respond.","source":"DL News / CoinTelegraph","source_url":"https://www.dlnews.com/articles/defi/coinbased-backed-arcadia-finance-offers-hacker-bounty/"},{"date":"2025-07-14","event":"Attacker funds fresh wallet via Tornado Cash on Ethereum at 10:58 PM UTC in preparation for a new exploit targeting Arcadia Finance v2 Rebalancer contract on Base.","source":"Rekt News","source_url":"https://rekt.news/arcadiafi-rekt"},{"date":"2025-07-15","event":"Arcadia Finance v2 Rebalancer contract exploited on Base for approximately $2.5M (total later estimated at $3.6M across two attack waves). Attacker bridges 840 ETH to Ethereum mainnet via Across Protocol. AAA token drops 46%. Team offers 10% white-hat bounty; attacker does not comply.","source":"Rekt News / CoinTelegraph","source_url":"https://cointelegraph.com/news/arcadia-finance-exploit-2-5m-crypto-theft"}],"sources_used":[{"url":"https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0","name":"Arcadia Finance Post Mortem — Medium","type":"official","archive_url":"http://web.archive.org/web/20260322055930/https://arcadiafinance.medium.com/post-mortem-72e9d24a79b0","credibility":1,"archive_timestamp":"2026-03-22T05:59:30+00:00"},{"url":"https://docs.arcadia.finance/security-and-risk/audits","name":"Arcadia Finance Security & Audits documentation","type":"official","archive_url":"http://web.archive.org/web/20260422084441/https://docs.arcadia.finance/security-and-risk/audits","credibility":1,"archive_timestamp":"2026-04-22T08:44:41+00:00"},{"url":"https://cointelegraph.com/news/arcadia-finance-hacked-on-ethereum-and-optimism-for-455k","name":"DeFi protocol Arcadia Finance hacked on Ethereum and Optimism for $455K — CoinTelegraph","type":"news_article","archive_url":"https://web.archive.org/web/20260829113428/https://cointelegraph.com/news/arcadia-finance-hacked-on-ethereum-and-optimism-for-455k","credibility":2,"archive_timestamp":"2026-08-29T11:34:28+00:00"},{"url":"https://cointelegraph.com/news/arcadia-finance-hacker-used-reentrancy-exploit-team-demands-return-of-funds","name":"Arcadia Finance hacker used reentrancy exploit, team demands return of funds — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20250827164200/https://cointelegraph.com/news/arcadia-finance-hacker-used-reentrancy-exploit-team-demands-return-of-funds","credibility":2,"archive_timestamp":"2025-08-27T16:42:00+00:00"},{"url":"https://cointelegraph.com/news/arcadia-finance-exploit-2-5m-crypto-theft","name":"Arcadia Finance Suffers $2.5M Exploit on Base — CoinTelegraph","type":"news_article","archive_url":"https://web.archive.org/web/20260830115057/https://cointelegraph.com/news/arcadia-finance-exploit-2-5m-crypto-theft","credibility":2,"archive_timestamp":"2026-08-30T11:50:57+00:00"},{"url":"https://protos.com/arcadia-finance-says-exploiter-contacted-after-450k-hack/","name":"Arcadia Finance says exploiter contacted after $450K hack — Protos","type":"news_article","archive_url":"http://web.archive.org/web/20260521161729/https://protos.com/arcadia-finance-says-exploiter-contacted-after-450k-hack/","credibility":2,"archive_timestamp":"2026-05-21T16:17:29+00:00"},{"url":"https://www.dlnews.com/articles/defi/coinbased-backed-arcadia-finance-offers-hacker-bounty/","name":"Arcadia Finance hits $3.5m hacker with ultimatum — DL News","type":"news_article","archive_url":"http://web.archive.org/web/20260617134325/https://www.dlnews.com/articles/defi/coinbased-backed-arcadia-finance-offers-hacker-bounty/","credibility":2,"archive_timestamp":"2026-06-17T13:43:25+00:00"},{"url":"https://cryptodaily.co.uk/2023/07/defi-platform-arcadia-finance-hacked-for-455k","name":"DeFi Platform Arcadia Finance Hacked for $455K — Crypto Daily","type":"news_article","archive_url":"http://web.archive.org/web/20250725183550/https://cryptodaily.co.uk/2023/07/defi-platform-arcadia-finance-hacked-for-455k","credibility":2,"archive_timestamp":"2025-07-25T18:35:50+00:00"},{"url":"https://cryptobriefing.com/defi-protocol-hack-drains-455k/","name":"DeFi Protocol Hack Drains $455K from Arcadia Finance — Crypto Briefing","type":"news_article","archive_url":"http://web.archive.org/web/20251209022308/https://cryptobriefing.com/defi-protocol-hack-drains-455k/","credibility":2,"archive_timestamp":"2025-12-09T02:23:08+00:00"},{"url":"https://cryptopotato.com/arcadia-finance-hit-by-455k-exploit-on-both-ethereum-optimism-networks/","name":"Arcadia Finance Hit by $455K Exploit on Both Ethereum, Optimism Networks — CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20250906160135/https://cryptopotato.com/arcadia-finance-hit-by-455k-exploit-on-both-ethereum-optimism-networks/","credibility":2,"archive_timestamp":"2025-09-06T16:01:35+00:00"},{"url":"https://www.outlookbusiness.com/news/latest-crypto-news-hacker-drains-455k-from-arcadia-s-ethereum-optimism-vaults-zachxbt-s-research-cited-in-canadian-nft-rug-pull-class-action-lawsuit-news-301762","name":"Hacker drains $455K from Arcadia's Ethereum, Optimism Vaults; ZachXBT's Research Cited — Outlook Business","type":"news_article","archive_url":"http://web.archive.org/web/20260419141429/https://www.outlookbusiness.com/news/latest-crypto-news-hacker-drains-455k-from-arcadia-s-ethereum-optimism-vaults-zachxbt-s-research-cited-in-canadian-nft-rug-pull-class-action-lawsuit-news-301762","credibility":2,"archive_timestamp":"2026-04-19T14:14:29+00:00"},{"url":"https://rekt.news/arcadiafi-rekt","name":"ArcadiaFi — Rekt News","type":"research","archive_url":"http://web.archive.org/web/20260513172253/https://rekt.news/arcadiafi-rekt","credibility":2,"archive_timestamp":"2026-05-13T17:22:53+00:00"},{"url":"https://cryptonews.com/news/hackers-drain-2-5m-from-arcadia-finance-on-base-blockchain-heres-what-happened/","name":"Hackers Drain $2.5M from Arcadia Finance on Base Blockchain — CryptoNews","type":"news_article","archive_url":"http://web.archive.org/web/20250813233238/https://cryptonews.com/news/hackers-drain-2-5m-from-arcadia-finance-on-base-blockchain-heres-what-happened/","credibility":2,"archive_timestamp":"2025-08-13T23:32:38+00:00"},{"url":"https://cryptonews.com/news/defi-platform-arcadia-finance-falls-victim-455k-hack-ethereum-optimism/","name":"DeFi Platform Arcadia Finance Falls Victim to $455K Hack — CryptoNews","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://zachxbt.mirror.xyz/","name":"ZachXBT — Mirror.xyz","type":"other","archive_url":"http://web.archive.org/web/20251025091919/https://zachxbt.mirror.xyz/","credibility":2,"archive_timestamp":"2025-10-25T09:19:19+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:40.404372+00:00","updated_at":"2026-08-30T12:41:17.568607+00:00"}}